Manage API keys, identities, permissions, rate-limit overrides and verification analytics. Hosted by usefulapi — connect from Claude, Cursor, or any MCP client.
Team and Enterprise: an Owner adds the connector for the organization first.
Run this command, then run /mcp in Claude Code to log in:
Add to Cursor or add this to ~/.cursor/mcp.json:
{
"mcpServers": {
"unkey": {
"url": "https://unkey.usefulapi.io/mcp"
}
}
}Add to VS Code or add this to .vscode/mcp.json:
{
"servers": {
"unkey": {
"type": "http",
"url": "https://unkey.usefulapi.io/mcp"
}
}
}Other MCP clients (Windsurf, Cline, Zed and more): add the URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser. Do not add an Authorization header: see Before you connect.
The login page asks for your Unkey root key.
Create one in Unkey → Settings → Root Keys. Your token is used only to call the API on your behalf and to derive a private account id; it is never shown to anyone.
Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Unkey root key. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
Turn on the Unkey connector, then ask in plain words. The AI picks the tools.
| Tool | Type | What it does |
|---|---|---|
unkey_liveness | read | Check API health Check that the Unkey API is reachable and the root key works. The only GET in the v2 surface. Unkey: GET /v2/liveness. |
unkey_get_key | read | Get one key by id Fetch a key's metadata by its key id — name, owner, permissions, credits, rate limits and whether it is enabled. Read-only despite being a POST. Unkey: POST /v2/keys.getKey. |
unkey_whoami_key | read | Look up a key by its secret Given a plaintext API key, return which key it is and its metadata — without spending credits or recording a verification. This is the safe way to identify a key a customer sent you. Unkey: POST /v2/keys.whoami. |
unkey_get_api | read | Get one API Fetch an API namespace by id. Read-only despite being a POST. Unkey: POST /v2/apis.getApi. |
unkey_list_api_keys | read | List the keys of an API List every key issued under one API, optionally narrowed to a single customer by externalId. Read-only despite being a POST. Unkey: POST /v2/apis.listKeys. |
unkey_list_identities | read | List identities List identities — the end users or organisations your keys belong to. Read-only despite being a POST. Unkey: POST /v2/identities.listIdentities. |
unkey_get_identity | read | Get one identity Fetch a single identity with its metadata and shared rate limits. Read-only despite being a POST. Unkey: POST /v2/identities.getIdentity. |
unkey_list_permissions | read | List permissions List the permissions defined in the workspace. Read-only despite being a POST. Unkey: POST /v2/permissions.listPermissions. |
unkey_list_roles | read | List roles List the roles defined in the workspace. Read-only despite being a POST. Unkey: POST /v2/permissions.listRoles. |
unkey_list_ratelimit_overrides | read | List rate-limit overrides List the per-identifier overrides in one rate-limit namespace. Read-only despite being a POST. Unkey: POST /v2/ratelimit.listOverrides. |
unkey_get_ratelimit_override | read | Get one rate-limit override Fetch the override for one identifier in a namespace. Read-only despite being a POST. Unkey: POST /v2/ratelimit.getOverride. |
unkey_query_verification_analytics | read | Query key-verification analytics Run a read-only SQL query over key-verification analytics. The query must use one of the public aliases: key_verifications_v1, key_verifications_per_minute_v1, key_verifications_per_hour_v1, key_verifications_per_day_v1 or key_verifications_per_month_v1. Physical default.* table names are rejected, and results are scoped to your workspace. Unkey: POST /v2/analytics.getVerifications. |
unkey_create_api | write | Create an API Create a new API namespace to issue keys under. Unkey: POST /v2/apis.createApi. |
unkey_create_key | write | Create an API key Issue a new API key under an API. The plaintext key is returned ONCE in the response and cannot be retrieved later unless recoverable is set. Unkey: POST /v2/keys.createKey. |
unkey_update_key | write | Update a key Change a key's name, owner, metadata, expiry, roles, permissions or enabled state. Unkey: POST /v2/keys.updateKey. |
unkey_update_key_credits | write | Update a key's credits Set, increment or decrement a key's remaining credits. Use set with no value for unlimited. Unkey: POST /v2/keys.updateCredits. |
unkey_delete_key | write | Delete a key Revoke a key. By default this is a soft delete the key stops working but stays queryable; pass permanent to erase it. Unkey: POST /v2/keys.deleteKey. |
unkey_create_identity | write | Create an identity Create an identity — an end user or organisation that keys and shared rate limits attach to. Unkey: POST /v2/identities.createIdentity. |
unkey_set_ratelimit_override | write | Set a rate-limit override Set a custom rate limit for one identifier in a namespace — how you raise or lower a single customer's limit. Unkey: POST /v2/ratelimit.setOverride. |
unkey_usage_status | Usage status (free-tier meter) Report the caller's current free-tier usage this month: calls used, monthly limit, remaining, and whether the cap is reached. Read-only; does not count against the meter. | |
unkey_request_feature | Request a missing feature Tell usefulapi that the user needs something the Unkey tools cannot do yet (a missing tool, field or filter). Call it only when the user asks for something none of the tools can do, and tell the user that you send the request. Do not call it for errors or for normal requests. Do not include personal data, credentials or customer records. Stored with the product name and the client type (for example Claude or Cursor), without the user's account. At most 5 requests per day. Does not count against the meter. | |
unkey_upgrade | Upgrade to Pro (unlimited) Subscribe to the Pro plan for UNLIMITED Unkey tool calls (the free tier caps monthly usage). Choose monthly ($9/month) or yearly ($90/year — 2 months free) billing. Returns a Stripe Checkout link to open in your browser; after payment your account upgrades automatically. Does not count against the meter. | |
unkey_cancel_subscription | Cancel the Pro subscription Cancel the caller's Unkey Pro subscription at the end of the paid period (no refund for the current period; unlimited calls continue until then, then the free tier applies). Requires confirm: true. Run unkey_upgrade later to undo the cancel before the period ends. Does not count against the meter. |
| Plan | Price | Limit |
|---|---|---|
| Free | $0 | 100 tool calls / month |
| Pro | $9/mo · $90/yr | Unlimited |
Pro covers this Unkey server only. Subscribe with unkey_upgrade (it returns a Stripe Checkout link). Cancel any time with unkey_cancel_subscription: Pro continues to the end of the paid period, with no refund for the current period, and running unkey_upgrade before then undoes the cancel. Or write to [email protected].
No. usefulapi is an independent service. It is not affiliated with or endorsed by Unkey. The server calls the Unkey API with your own Unkey access, so it sees only the data that your account can see.
The login page asks for your Unkey root key. See Before you connect for where to find it.
No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Unkey root key. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
The login stores them encrypted in the authorization grant of your connection. The server uses them to call the Unkey API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in Unkey.
Yes, if you approve it. 7 of the 19 Unkey tools can create or change data. The other 12 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.
The Free plan gives 100 tool calls / month. Pro costs $9/mo or $90/yr, with unlimited tool calls, for this Unkey server only. Run unkey_usage_status to see how many calls you used.
Ask the AI to run unkey_upgrade: it returns a Stripe Checkout link. To cancel, run unkey_cancel_subscription. Pro continues to the end of the paid period.
Tell the AI what you wanted to do. It can send the request with unkey_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.
Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, Cursor, VS Code, Windsurf and others.
This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.